Beyond PowerShell: Anatomy of the Stealthy New ClickFix “Living-off-the-Land” Attack

Cybersecurity researchers have identified a sophisticated new evolution in the ClickFix attack lineage. Moving away from the relatively noisy use of PowerShell, this variant leverages a highly stealthy “Living-off-the-Land” (LotL) strategy, utilizing native Windows utilities to bypass traditional endpoint detection and response (EDR) systems.

The attack sequence begins with a psychological exploit: social engineering. Victims encounter a fraudulent phishing page designed to look like a standard CAPTCHA verification prompt. To “verify” their humanity, users are tricked into performing a highly manual, yet seemingly innocuous, sequence: pressing Win + R, pasting a specific command string, and hitting Enter.

This single user-initiated action triggers a complex, multi-stage execution chain that avoids the immediate download of a suspicious executable file, making it much harder for signature-based antivirus to flag the initial entry.

Analysis by the CyberProof Threat Research Team reveals that the command utilizes cmd.exe to orchestrate several critical operations in a single line. The first step involves the cmdkey utility, which is used to stage credentials for a remote, attacker-controlled system. By using a legitimate Windows tool for credential management, the attacker masks their preparation phase within standard system noise.

Following credential staging, the attack utilizes regsvr32.exe to silently reach out to a remote SMB share via a UNC path to retrieve and execute a malicious DLL. To further blend in, the command includes embedded comment text that mimics legitimate Cloudflare verification strings, providing a layer of “security through obscurity.”

Deep Dive: Technical Analysis of the Payload

The primary payload is a 64-bit Dynamic Link Library (DLL) named demo.dll. This file is loaded and executed via regsvr32 through its DllRegisterServer export function—a common technique used to bypass security controls that monitor for direct process execution.

Rather than immediately deploying high-impact malware (like ransomware), the DLL takes a conservative approach to establish long-term access. It utilizes CreateProcessA to invoke schtasks.exe, thereby creating a scheduled task for persistence. However, there is a significant architectural twist: the task configuration is not stored locally on the victim’s machine.

Instead, the malware fetches an XML configuration file from a remote, attacker-controlled server. This allows the attackers to name the task something deceptively benign, such as “RunNotepadNow,” which is likely to be overlooked by a casual observer or an automated log review. This modular, remote-orchestrated design is a game-changer; it allows the threat actor to modify the task’s behavior, updates, or secondary payloads in real-time without needing to touch the initial demo.dll file on the infected host.

While the Command and Control (C2) infrastructure for this specific campaign was found to be offline during analysis, the modularity of the code suggests a highly adaptable framework designed for prolonged, low-and-slow operations.

The Shift in Threat Landscapes

This ClickFix variant represents a significant maturation in how threat actors navigate modern security environments. Instead of fighting against security tools, they are using the tools’ own logic against them. Key takeaways include:

• Tool Substitution: Replacing more commonly monitored tools like PowerShell and rundll32 with cmdkey and regsvr32.
• Chained Execution: Using command-line operators to string together multiple legitimate utilities into a single, lethal flow.
• LOLBins Abuse: Relying entirely on “Living-off-the-Land Binaries” to minimize the footprint of suspicious files.
• Remote Orchestration: Leveraging remote XML files to drive persistent behavior, decoupling the payload from its configuration.

How to Detect and Defend

Defenders can no longer rely solely on file-based detection. To counter this evolution, security operations centers (SOCs) should focus on behavioral indicators, such as:

• Suspicious Command Line Arguments: Monitoring for cmd.exe utilizing chained operators (&& or &) for complex operations.
• Credential Tool Misuse: Investigating cmdkey operations that target external or non-standard IP addresses.
• Remote DLL Loading: Flagging regsvr32.exe when it attempts to load files from remote UNC paths.
• Anomalous Scheduled Tasks: Auditing the creation of scheduled tasks, particularly those that pull configurations from external web sources.

As attackers increasingly align their movements with legitimate system administration activities, our detection strategies must move toward holistic behavioral analysis and zero-trust execution models.